diff --git a/workplans/USER-WP-0021-portal-product-expansion.md b/workplans/USER-WP-0021-portal-product-expansion.md
index c7bbe6e..4676d32 100644
--- a/workplans/USER-WP-0021-portal-product-expansion.md
+++ b/workplans/USER-WP-0021-portal-product-expansion.md
@@ -185,7 +185,11 @@ and rolled out successfully on Railiance. Public health returns schema
 without a session, rather than 404). The rollout replaces in-memory OIDC
 sessions, so existing browsers must authenticate again.
 
-The tenant authority is not currently deployed in the cluster. Platform
-tenant creation therefore remains fail-closed behind the implemented optional
-`TenantManagementPort`; this is part of the remaining T01 tenant-management
-integration rather than a hidden local tenant registry.
+2026-08-09 production follow-up: tenant-engine and its dedicated flex-auth
+policy service are deployed with persistent storage and least-privilege
+networking. The portal adapter created a tenant successfully and the record
+survived a tenant-engine restart. The separate user-engine flex-auth policy is
+also deployed and has live self-service-allow/cross-tenant-deny evidence, but
+the portal runtime switch remains gated on approved event and mail receivers.
+T01 remains open only for broader tenant update/retirement operations and the
+final outbox transport activation.